Vulnerability-Lookup

usn-6765-1

Vulnerability from osv_ubuntu

Published

2024-05-07 15:22

Modified

2024-05-07 15:22

Summary

linux-oem-6.5 vulnerabilities

Details

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - Core kernel; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Android drivers; - Drivers core; - Power management core; - Bus devices; - Hardware random number generator core; - Device frequency; - DMA engine subsystem; - EDAC drivers; - ARM SCMI message protocol; - GPU drivers; - IIO ADC drivers; - InfiniBand drivers; - IOMMU subsystem; - Media drivers; - Multifunction device drivers; - MTD block device drivers; - Network drivers; - NVME drivers; - PCI driver for MicroSemi Switchtec; - x86 platform drivers; - Power supply drivers; - SCSI drivers; - QCOM SoC drivers; - SPMI drivers; - Thermal drivers; - TTY drivers; - VFIO drivers; - BTRFS file system; - Ceph distributed file system; - EFI Variable file system; - EROFS file system; - Ext4 file system; - F2FS file system; - GFS2 file system; - JFS file system; - Network file systems library; - Network file system server daemon; - Pstore file system; - ReiserFS file system; - SMB network file system; - BPF subsystem; - Memory management; - TLS protocol; - Networking core; - IPv4 networking; - IPv6 networking; - Logical Link layer; - Netfilter; - Network traffic control; - SMC sockets; - Sun RPC protocol; - AppArmor security module; (CVE-2023-52635, CVE-2024-26632, CVE-2023-52468, CVE-2023-52472, CVE-2023-52589, CVE-2024-26671, CVE-2024-26640, CVE-2024-26631, CVE-2023-52489, CVE-2023-52616, CVE-2023-52445, CVE-2023-52463, CVE-2024-26610, CVE-2023-52497, CVE-2023-52453, CVE-2023-52470, CVE-2024-26649, CVE-2023-52583, CVE-2024-26644, CVE-2023-52607, CVE-2023-52587, CVE-2024-26594, CVE-2023-52618, CVE-2023-52495, CVE-2023-52632, CVE-2024-26583, CVE-2023-52633, CVE-2023-52591, CVE-2024-26633, CVE-2023-52627, CVE-2024-26670, CVE-2024-26598, CVE-2024-26592, CVE-2023-52473, CVE-2023-52623, CVE-2023-52446, CVE-2023-52443, CVE-2023-52451, CVE-2024-26629, CVE-2023-52462, CVE-2024-26808, CVE-2023-52598, CVE-2023-52611, CVE-2023-52492, CVE-2023-52456, CVE-2023-52626, CVE-2023-52455, CVE-2024-26641, CVE-2023-52588, CVE-2023-52608, CVE-2024-26618, CVE-2024-26582, CVE-2023-52609, CVE-2023-52604, CVE-2024-26646, CVE-2024-26634, CVE-2023-52469, CVE-2023-52467, CVE-2023-52447, CVE-2024-26623, CVE-2023-52621, CVE-2024-26647, CVE-2024-26615, CVE-2023-52450, CVE-2023-52619, CVE-2023-52610, CVE-2023-52606, CVE-2023-52464, CVE-2023-52465, CVE-2024-26638, CVE-2023-52498, CVE-2024-26625, CVE-2023-52449, CVE-2023-52584, CVE-2023-52454, CVE-2023-52458, CVE-2024-26585, CVE-2024-26669, CVE-2023-52493, CVE-2024-26645, CVE-2024-26607, CVE-2023-52615, CVE-2023-52617, CVE-2024-26612, CVE-2024-26668, CVE-2023-52594, CVE-2023-52612, CVE-2024-26584, CVE-2024-26586, CVE-2024-26616, CVE-2024-26673, CVE-2023-52448, CVE-2024-26620, CVE-2023-52614, CVE-2024-26636, CVE-2023-52602, CVE-2023-52452, CVE-2023-52601, CVE-2024-26635, CVE-2024-26627, CVE-2023-52488, CVE-2023-52487, CVE-2023-52597, CVE-2023-52494, CVE-2023-52444, CVE-2024-26608, CVE-2023-52593, CVE-2023-52491, CVE-2023-52595, CVE-2023-52599, CVE-2024-26595, CVE-2023-52622, CVE-2024-26650, CVE-2024-26614, CVE-2023-52490, CVE-2023-52486, CVE-2023-52457)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6765-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-52443	REPORT
	https://ubuntu.com/security/CVE-2023-52444	REPORT
	https://ubuntu.com/security/CVE-2023-52445	REPORT
	https://ubuntu.com/security/CVE-2023-52446	REPORT
	https://ubuntu.com/security/CVE-2023-52447	REPORT
	https://ubuntu.com/security/CVE-2023-52448	REPORT
	https://ubuntu.com/security/CVE-2023-52449	REPORT
	https://ubuntu.com/security/CVE-2023-52450	REPORT
	https://ubuntu.com/security/CVE-2023-52451	REPORT
	https://ubuntu.com/security/CVE-2023-52452	REPORT
	https://ubuntu.com/security/CVE-2023-52453	REPORT
	https://ubuntu.com/security/CVE-2023-52454	REPORT
	https://ubuntu.com/security/CVE-2023-52455	REPORT
	https://ubuntu.com/security/CVE-2023-52456	REPORT
	https://ubuntu.com/security/CVE-2023-52457	REPORT
	https://ubuntu.com/security/CVE-2023-52458	REPORT
	https://ubuntu.com/security/CVE-2023-52462	REPORT
	https://ubuntu.com/security/CVE-2023-52463	REPORT
	https://ubuntu.com/security/CVE-2023-52464	REPORT
	https://ubuntu.com/security/CVE-2023-52465	REPORT
	https://ubuntu.com/security/CVE-2023-52467	REPORT
	https://ubuntu.com/security/CVE-2023-52468	REPORT
	https://ubuntu.com/security/CVE-2023-52469	REPORT
	https://ubuntu.com/security/CVE-2023-52470	REPORT
	https://ubuntu.com/security/CVE-2023-52472	REPORT
	https://ubuntu.com/security/CVE-2023-52473	REPORT
	https://ubuntu.com/security/CVE-2023-52486	REPORT
	https://ubuntu.com/security/CVE-2023-52487	REPORT
	https://ubuntu.com/security/CVE-2023-52488	REPORT
	https://ubuntu.com/security/CVE-2023-52489	REPORT
	https://ubuntu.com/security/CVE-2023-52490	REPORT
	https://ubuntu.com/security/CVE-2023-52491	REPORT
	https://ubuntu.com/security/CVE-2023-52492	REPORT
	https://ubuntu.com/security/CVE-2023-52493	REPORT
	https://ubuntu.com/security/CVE-2023-52494	REPORT
	https://ubuntu.com/security/CVE-2023-52495	REPORT
	https://ubuntu.com/security/CVE-2023-52497	REPORT
	https://ubuntu.com/security/CVE-2023-52498	REPORT
	https://ubuntu.com/security/CVE-2023-52583	REPORT
	https://ubuntu.com/security/CVE-2023-52584	REPORT
	https://ubuntu.com/security/CVE-2023-52587	REPORT
	https://ubuntu.com/security/CVE-2023-52588	REPORT
	https://ubuntu.com/security/CVE-2023-52589	REPORT
	https://ubuntu.com/security/CVE-2023-52591	REPORT
	https://ubuntu.com/security/CVE-2023-52593	REPORT
	https://ubuntu.com/security/CVE-2023-52594	REPORT
	https://ubuntu.com/security/CVE-2023-52595	REPORT
	https://ubuntu.com/security/CVE-2023-52597	REPORT
	https://ubuntu.com/security/CVE-2023-52598	REPORT
	https://ubuntu.com/security/CVE-2023-52599	REPORT
	https://ubuntu.com/security/CVE-2023-52601	REPORT
	https://ubuntu.com/security/CVE-2023-52602	REPORT
	https://ubuntu.com/security/CVE-2023-52604	REPORT
	https://ubuntu.com/security/CVE-2023-52606	REPORT
	https://ubuntu.com/security/CVE-2023-52607	REPORT
	https://ubuntu.com/security/CVE-2023-52608	REPORT
	https://ubuntu.com/security/CVE-2023-52609	REPORT
	https://ubuntu.com/security/CVE-2023-52610	REPORT
	https://ubuntu.com/security/CVE-2023-52611	REPORT
	https://ubuntu.com/security/CVE-2023-52612	REPORT
	https://ubuntu.com/security/CVE-2023-52614	REPORT
	https://ubuntu.com/security/CVE-2023-52615	REPORT
	https://ubuntu.com/security/CVE-2023-52616	REPORT
	https://ubuntu.com/security/CVE-2023-52617	REPORT
	https://ubuntu.com/security/CVE-2023-52618	REPORT
	https://ubuntu.com/security/CVE-2023-52619	REPORT
	https://ubuntu.com/security/CVE-2023-52621	REPORT
	https://ubuntu.com/security/CVE-2023-52622	REPORT
	https://ubuntu.com/security/CVE-2023-52623	REPORT
	https://ubuntu.com/security/CVE-2023-52626	REPORT
	https://ubuntu.com/security/CVE-2023-52627	REPORT
	https://ubuntu.com/security/CVE-2023-52632	REPORT
	https://ubuntu.com/security/CVE-2023-52633	REPORT
	https://ubuntu.com/security/CVE-2023-52635	REPORT
	https://ubuntu.com/security/CVE-2023-6356	REPORT
	https://ubuntu.com/security/CVE-2023-6535	REPORT
	https://ubuntu.com/security/CVE-2023-6536	REPORT
	https://ubuntu.com/security/CVE-2024-2201	REPORT
	https://ubuntu.com/security/CVE-2024-23849	REPORT
	https://ubuntu.com/security/CVE-2024-24860	REPORT
	https://ubuntu.com/security/CVE-2024-26582	REPORT
	https://ubuntu.com/security/CVE-2024-26583	REPORT
	https://ubuntu.com/security/CVE-2024-26584	REPORT
	https://ubuntu.com/security/CVE-2024-26585	REPORT
	https://ubuntu.com/security/CVE-2024-26586	REPORT
	https://ubuntu.com/security/CVE-2024-26592	REPORT
	https://ubuntu.com/security/CVE-2024-26594	REPORT
	https://ubuntu.com/security/CVE-2024-26595	REPORT
	https://ubuntu.com/security/CVE-2024-26598	REPORT
	https://ubuntu.com/security/CVE-2024-26607	REPORT
	https://ubuntu.com/security/CVE-2024-26608	REPORT
	https://ubuntu.com/security/CVE-2024-26610	REPORT
	https://ubuntu.com/security/CVE-2024-26612	REPORT
	https://ubuntu.com/security/CVE-2024-26614	REPORT
	https://ubuntu.com/security/CVE-2024-26615	REPORT
	https://ubuntu.com/security/CVE-2024-26616	REPORT
	https://ubuntu.com/security/CVE-2024-26618	REPORT
	https://ubuntu.com/security/CVE-2024-26620	REPORT
	https://ubuntu.com/security/CVE-2024-26623	REPORT
	https://ubuntu.com/security/CVE-2024-26625	REPORT
	https://ubuntu.com/security/CVE-2024-26627	REPORT
	https://ubuntu.com/security/CVE-2024-26629	REPORT
	https://ubuntu.com/security/CVE-2024-26631	REPORT
	https://ubuntu.com/security/CVE-2024-26632	REPORT
	https://ubuntu.com/security/CVE-2024-26633	REPORT
	https://ubuntu.com/security/CVE-2024-26634	REPORT
	https://ubuntu.com/security/CVE-2024-26635	REPORT
	https://ubuntu.com/security/CVE-2024-26636	REPORT
	https://ubuntu.com/security/CVE-2024-26638	REPORT
	https://ubuntu.com/security/CVE-2024-26640	REPORT
	https://ubuntu.com/security/CVE-2024-26641	REPORT
	https://ubuntu.com/security/CVE-2024-26644	REPORT
	https://ubuntu.com/security/CVE-2024-26645	REPORT
	https://ubuntu.com/security/CVE-2024-26646	REPORT
	https://ubuntu.com/security/CVE-2024-26647	REPORT
	https://ubuntu.com/security/CVE-2024-26649	REPORT
	https://ubuntu.com/security/CVE-2024-26650	REPORT
	https://ubuntu.com/security/CVE-2024-26668	REPORT
	https://ubuntu.com/security/CVE-2024-26669	REPORT
	https://ubuntu.com/security/CVE-2024-26670	REPORT
	https://ubuntu.com/security/CVE-2024-26671	REPORT
	https://ubuntu.com/security/CVE-2024-26673	REPORT
	https://ubuntu.com/security/CVE-2024-26808	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription needed",
        "binaries": [
          {
            "linux-buildinfo-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-headers-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-headers-oem-22.04": "6.5.0.1022.24",
            "linux-headers-oem-22.04a": "6.5.0.1022.24",
            "linux-headers-oem-22.04b": "6.5.0.1022.24",
            "linux-headers-oem-22.04c": "6.5.0.1022.24",
            "linux-headers-oem-22.04d": "6.5.0.1022.24",
            "linux-image-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-image-oem-22.04": "6.5.0.1022.24",
            "linux-image-oem-22.04a": "6.5.0.1022.24",
            "linux-image-oem-22.04b": "6.5.0.1022.24",
            "linux-image-oem-22.04c": "6.5.0.1022.24",
            "linux-image-oem-22.04d": "6.5.0.1022.24",
            "linux-image-uc-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-image-uc-oem-22.04": "6.5.0.1022.24",
            "linux-image-uc-oem-22.04d": "6.5.0.1022.24",
            "linux-image-unsigned-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-modules-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-modules-ipu6-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-modules-ipu6-oem-22.04": "6.5.0.1022.24",
            "linux-modules-ipu6-oem-22.04b": "6.5.0.1022.24",
            "linux-modules-ipu6-oem-22.04c": "6.5.0.1022.24",
            "linux-modules-ipu6-oem-22.04d": "6.5.0.1022.24",
            "linux-modules-ivsc-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-modules-ivsc-oem-22.04": "6.5.0.1022.24",
            "linux-modules-ivsc-oem-22.04b": "6.5.0.1022.24",
            "linux-modules-ivsc-oem-22.04c": "6.5.0.1022.24",
            "linux-modules-ivsc-oem-22.04d": "6.5.0.1022.24",
            "linux-modules-iwlwifi-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-modules-iwlwifi-oem-22.04": "6.5.0.1022.24",
            "linux-modules-iwlwifi-oem-22.04b": "6.5.0.1022.24",
            "linux-modules-iwlwifi-oem-22.04c": "6.5.0.1022.24",
            "linux-modules-iwlwifi-oem-22.04d": "6.5.0.1022.24",
            "linux-modules-usbio-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-modules-usbio-oem-22.04": "6.5.0.1022.24",
            "linux-modules-usbio-oem-22.04d": "6.5.0.1022.24",
            "linux-oem-22.04": "6.5.0.1022.24",
            "linux-oem-22.04a": "6.5.0.1022.24",
            "linux-oem-22.04b": "6.5.0.1022.24",
            "linux-oem-22.04c": "6.5.0.1022.24",
            "linux-oem-22.04d": "6.5.0.1022.24",
            "linux-oem-6.5-headers-6.5.0-1022": "6.5.0-1022.23",
            "linux-oem-6.5-lib-rust-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-oem-6.5-tools-6.5.0-1022": "6.5.0-1022.23",
            "linux-oem-6.5-tools-host": "6.5.0-1022.23",
            "linux-tools-6.5.0-1022-oem": "6.5.0-1022.23",
            "linux-tools-oem-22.04": "6.5.0.1022.24",
            "linux-tools-oem-22.04a": "6.5.0.1022.24",
            "linux-tools-oem-22.04b": "6.5.0.1022.24",
            "linux-tools-oem-22.04c": "6.5.0.1022.24",
            "linux-tools-oem-22.04d": "6.5.0.1022.24"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "linux-oem-6.5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.5.0-1022.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "details": "Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel\ndid not properly validate H2C PDU data, leading to a null pointer\ndereference vulnerability. A remote attacker could use this to cause a\ndenial of service (system crash). (CVE-2023-6356, CVE-2023-6535,\nCVE-2023-6536)\n\nSander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida\ndiscovered that the Linux kernel mitigations for the initial Branch History\nInjection vulnerability (CVE-2022-0001) were insufficient for Intel\nprocessors. A local attacker could potentially use this to expose sensitive\ninformation. (CVE-2024-2201)\n\nChenyuan Yang discovered that the RDS Protocol implementation in the Linux\nkernel contained an out-of-bounds read vulnerability. An attacker could use\nthis to possibly cause a denial of service (system crash). (CVE-2024-23849)\n\nIt was discovered that a race condition existed in the Bluetooth subsystem\nin the Linux kernel, leading to a null pointer dereference vulnerability. A\nprivileged local attacker could use this to possibly cause a denial of\nservice (system crash). (CVE-2024-24860)\n\nSeveral security issues were discovered in the Linux kernel.\nAn attacker could possibly use these to compromise the system.\nThis update corrects flaws in the following subsystems:\n  - ARM64 architecture;\n  - PowerPC architecture;\n  - S390 architecture;\n  - Core kernel;\n  - x86 architecture;\n  - Block layer subsystem;\n  - Cryptographic API;\n  - Android drivers;\n  - Drivers core;\n  - Power management core;\n  - Bus devices;\n  - Hardware random number generator core;\n  - Device frequency;\n  - DMA engine subsystem;\n  - EDAC drivers;\n  - ARM SCMI message protocol;\n  - GPU drivers;\n  - IIO ADC drivers;\n  - InfiniBand drivers;\n  - IOMMU subsystem;\n  - Media drivers;\n  - Multifunction device drivers;\n  - MTD block device drivers;\n  - Network drivers;\n  - NVME drivers;\n  - PCI driver for MicroSemi Switchtec;\n  - x86 platform drivers;\n  - Power supply drivers;\n  - SCSI drivers;\n  - QCOM SoC drivers;\n  - SPMI drivers;\n  - Thermal drivers;\n  - TTY drivers;\n  - VFIO drivers;\n  - BTRFS file system;\n  - Ceph distributed file system;\n  - EFI Variable file system;\n  - EROFS file system;\n  - Ext4 file system;\n  - F2FS file system;\n  - GFS2 file system;\n  - JFS file system;\n  - Network file systems library;\n  - Network file system server daemon;\n  - Pstore file system;\n  - ReiserFS file system;\n  - SMB network file system;\n  - BPF subsystem;\n  - Memory management;\n  - TLS protocol;\n  - Networking core;\n  - IPv4 networking;\n  - IPv6 networking;\n  - Logical Link layer;\n  - Netfilter;\n  - Network traffic control;\n  - SMC sockets;\n  - Sun RPC protocol;\n  - AppArmor security module;\n(CVE-2023-52635, CVE-2024-26632, CVE-2023-52468, CVE-2023-52472,\nCVE-2023-52589, CVE-2024-26671, CVE-2024-26640, CVE-2024-26631,\nCVE-2023-52489, CVE-2023-52616, CVE-2023-52445, CVE-2023-52463,\nCVE-2024-26610, CVE-2023-52497, CVE-2023-52453, CVE-2023-52470,\nCVE-2024-26649, CVE-2023-52583, CVE-2024-26644, CVE-2023-52607,\nCVE-2023-52587, CVE-2024-26594, CVE-2023-52618, CVE-2023-52495,\nCVE-2023-52632, CVE-2024-26583, CVE-2023-52633, CVE-2023-52591,\nCVE-2024-26633, CVE-2023-52627, CVE-2024-26670, CVE-2024-26598,\nCVE-2024-26592, CVE-2023-52473, CVE-2023-52623, CVE-2023-52446,\nCVE-2023-52443, CVE-2023-52451, CVE-2024-26629, CVE-2023-52462,\nCVE-2024-26808, CVE-2023-52598, CVE-2023-52611, CVE-2023-52492,\nCVE-2023-52456, CVE-2023-52626, CVE-2023-52455, CVE-2024-26641,\nCVE-2023-52588, CVE-2023-52608, CVE-2024-26618, CVE-2024-26582,\nCVE-2023-52609, CVE-2023-52604, CVE-2024-26646, CVE-2024-26634,\nCVE-2023-52469, CVE-2023-52467, CVE-2023-52447, CVE-2024-26623,\nCVE-2023-52621, CVE-2024-26647, CVE-2024-26615, CVE-2023-52450,\nCVE-2023-52619, CVE-2023-52610, CVE-2023-52606, CVE-2023-52464,\nCVE-2023-52465, CVE-2024-26638, CVE-2023-52498, CVE-2024-26625,\nCVE-2023-52449, CVE-2023-52584, CVE-2023-52454, CVE-2023-52458,\nCVE-2024-26585, CVE-2024-26669, CVE-2023-52493, CVE-2024-26645,\nCVE-2024-26607, CVE-2023-52615, CVE-2023-52617, CVE-2024-26612,\nCVE-2024-26668, CVE-2023-52594, CVE-2023-52612, CVE-2024-26584,\nCVE-2024-26586, CVE-2024-26616, CVE-2024-26673, CVE-2023-52448,\nCVE-2024-26620, CVE-2023-52614, CVE-2024-26636, CVE-2023-52602,\nCVE-2023-52452, CVE-2023-52601, CVE-2024-26635, CVE-2024-26627,\nCVE-2023-52488, CVE-2023-52487, CVE-2023-52597, CVE-2023-52494,\nCVE-2023-52444, CVE-2024-26608, CVE-2023-52593, CVE-2023-52491,\nCVE-2023-52595, CVE-2023-52599, CVE-2024-26595, CVE-2023-52622,\nCVE-2024-26650, CVE-2024-26614, CVE-2023-52490, CVE-2023-52486,\nCVE-2023-52457)\n",
  "id": "USN-6765-1",
  "modified": "2024-05-07T15:22:10.940719Z",
  "published": "2024-05-07T15:22:10.940719Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6765-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52443"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52444"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52445"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52446"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52447"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52448"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52449"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52450"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52451"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52452"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52453"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52454"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52455"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52456"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52457"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52458"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52462"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52463"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52464"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52465"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52467"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52468"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52469"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52470"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52472"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52473"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52486"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52487"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52488"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52489"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52490"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52491"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52492"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52493"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52494"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52495"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52497"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52498"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52583"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52584"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52587"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52588"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52589"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52591"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52593"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52594"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52595"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52597"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52598"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52599"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52601"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52602"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52604"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52606"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52607"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52608"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52609"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52610"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52611"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52612"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52614"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52615"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52616"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52617"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52618"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52619"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52621"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52622"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52623"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52626"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52627"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52632"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52633"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-52635"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6356"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6535"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-6536"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-2201"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-23849"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-24860"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26582"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26583"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26584"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26585"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26586"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26592"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26594"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26595"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26598"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26607"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26608"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26610"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26612"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26614"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26615"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26616"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26618"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26620"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26623"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26625"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26627"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26629"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26631"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26632"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26633"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26634"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26635"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26636"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26638"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26640"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26641"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26644"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26645"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26646"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26647"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26649"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26650"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26668"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26669"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26670"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26671"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26673"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-26808"
    }
  ],
  "related": [
    "CVE-2023-52443",
    "CVE-2023-52444",
    "CVE-2023-52445",
    "CVE-2023-52446",
    "CVE-2023-52447",
    "CVE-2023-52448",
    "CVE-2023-52449",
    "CVE-2023-52450",
    "CVE-2023-52451",
    "CVE-2023-52452",
    "CVE-2023-52453",
    "CVE-2023-52454",
    "CVE-2023-52455",
    "CVE-2023-52456",
    "CVE-2023-52457",
    "CVE-2023-52458",
    "CVE-2023-52462",
    "CVE-2023-52463",
    "CVE-2023-52464",
    "CVE-2023-52465",
    "CVE-2023-52467",
    "CVE-2023-52468",
    "CVE-2023-52469",
    "CVE-2023-52470",
    "CVE-2023-52472",
    "CVE-2023-52473",
    "CVE-2023-52486",
    "CVE-2023-52487",
    "CVE-2023-52488",
    "CVE-2023-52489",
    "CVE-2023-52490",
    "CVE-2023-52491",
    "CVE-2023-52492",
    "CVE-2023-52493",
    "CVE-2023-52494",
    "CVE-2023-52495",
    "CVE-2023-52497",
    "CVE-2023-52498",
    "CVE-2023-52583",
    "CVE-2023-52584",
    "CVE-2023-52587",
    "CVE-2023-52588",
    "CVE-2023-52589",
    "CVE-2023-52591",
    "CVE-2023-52593",
    "CVE-2023-52594",
    "CVE-2023-52595",
    "CVE-2023-52597",
    "CVE-2023-52598",
    "CVE-2023-52599",
    "CVE-2023-52601",
    "CVE-2023-52602",
    "CVE-2023-52604",
    "CVE-2023-52606",
    "CVE-2023-52607",
    "CVE-2023-52608",
    "CVE-2023-52609",
    "CVE-2023-52610",
    "CVE-2023-52611",
    "CVE-2023-52612",
    "CVE-2023-52614",
    "CVE-2023-52615",
    "CVE-2023-52616",
    "CVE-2023-52617",
    "CVE-2023-52618",
    "CVE-2023-52619",
    "CVE-2023-52621",
    "CVE-2023-52622",
    "CVE-2023-52623",
    "CVE-2023-52626",
    "CVE-2023-52627",
    "CVE-2023-52632",
    "CVE-2023-52633",
    "CVE-2023-52635",
    "CVE-2023-6356",
    "CVE-2023-6535",
    "CVE-2023-6536",
    "CVE-2024-2201",
    "CVE-2024-23849",
    "CVE-2024-24860",
    "CVE-2024-26582",
    "CVE-2024-26583",
    "CVE-2024-26584",
    "CVE-2024-26585",
    "CVE-2024-26586",
    "CVE-2024-26592",
    "CVE-2024-26594",
    "CVE-2024-26595",
    "CVE-2024-26598",
    "CVE-2024-26607",
    "CVE-2024-26608",
    "CVE-2024-26610",
    "CVE-2024-26612",
    "CVE-2024-26614",
    "CVE-2024-26615",
    "CVE-2024-26616",
    "CVE-2024-26618",
    "CVE-2024-26620",
    "CVE-2024-26623",
    "CVE-2024-26625",
    "CVE-2024-26627",
    "CVE-2024-26629",
    "CVE-2024-26631",
    "CVE-2024-26632",
    "CVE-2024-26633",
    "CVE-2024-26634",
    "CVE-2024-26635",
    "CVE-2024-26636",
    "CVE-2024-26638",
    "CVE-2024-26640",
    "CVE-2024-26641",
    "CVE-2024-26644",
    "CVE-2024-26645",
    "CVE-2024-26646",
    "CVE-2024-26647",
    "CVE-2024-26649",
    "CVE-2024-26650",
    "CVE-2024-26668",
    "CVE-2024-26669",
    "CVE-2024-26670",
    "CVE-2024-26671",
    "CVE-2024-26673",
    "CVE-2024-26808"
  ],
  "summary": "linux-oem-6.5 vulnerabilities",
  "withdrawn": "2024-05-07T16:22:10.940719Z"
}

CVE-2023-52443 (GCVE-0-2023-52443)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:13 – Updated: 2026-05-11 19:27

Title

apparmor: avoid crash when parsed profile name is empty

Summary

In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname(). aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now. general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0 It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside. AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace. Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message. Found by Linux Verification Center (linuxtesting.org).

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

10 references

URL	Tags
https://git.kernel.org/stable/c/9286ee97aa4803d99…
https://git.kernel.org/stable/c/1d8e62b5569cc1466…
https://git.kernel.org/stable/c/5ff00408e5029d355…
https://git.kernel.org/stable/c/0a12db736edbb4933…
https://git.kernel.org/stable/c/9d4fa5fe2b1d56662…
https://git.kernel.org/stable/c/5c0392fdafb0a2321…
https://git.kernel.org/stable/c/77ab09b92f16c8439…
https://git.kernel.org/stable/c/55a8210c9e7d21ff2…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 9286ee97aa4803d99185768735011d0d65827c9e (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 5ff00408e5029d3550ee77f62dc15f1e15c47f87 (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 0a12db736edbb4933e4274932aeea594b5876fa4 (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 9d4fa5fe2b1d56662afd14915a73b4d0783ffa45 (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 5c0392fdafb0a2321311900be83ffa572bef8203 (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 77ab09b92f16c8439a948d1af489196953dc4a0e (git) Affected: 04dc715e24d0820bf8740e1a1135ed61fe162bc8 , < 55a8210c9e7d21ff2644809699765796d4bfb200 (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T18:29:41.510350Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:01.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.517Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9286ee97aa4803d99185768735011d0d65827c9e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ff00408e5029d3550ee77f62dc15f1e15c47f87"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0a12db736edbb4933e4274932aeea594b5876fa4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9d4fa5fe2b1d56662afd14915a73b4d0783ffa45"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5c0392fdafb0a2321311900be83ffa572bef8203"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/77ab09b92f16c8439a948d1af489196953dc4a0e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/55a8210c9e7d21ff2644809699765796d4bfb200"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9286ee97aa4803d99185768735011d0d65827c9e",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "5ff00408e5029d3550ee77f62dc15f1e15c47f87",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "0a12db736edbb4933e4274932aeea594b5876fa4",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "9d4fa5fe2b1d56662afd14915a73b4d0783ffa45",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "5c0392fdafb0a2321311900be83ffa572bef8203",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "77ab09b92f16c8439a948d1af489196953dc4a0e",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            },
            {
              "lessThan": "55a8210c9e7d21ff2644809699765796d4bfb200",
              "status": "affected",
              "version": "04dc715e24d0820bf8740e1a1135ed61fe162bc8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/policy_unpack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: avoid crash when parsed profile name is empty\n\nWhen processing a packed profile in unpack_profile() described like\n\n \"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}\"\n\na string \":samba-dcerpcd\" is unpacked as a fully-qualified name and then\npassed to aa_splitn_fqname().\n\naa_splitn_fqname() treats \":samba-dcerpcd\" as only containing a namespace.\nThus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later\naa_alloc_profile() crashes as the new profile name is NULL now.\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\nRIP: 0010:strlen+0x1e/0xa0\nCall Trace:\n \u003cTASK\u003e\n ? strlen+0x1e/0xa0\n aa_policy_init+0x1bb/0x230\n aa_alloc_profile+0xb1/0x480\n unpack_profile+0x3bc/0x4960\n aa_unpack+0x309/0x15e0\n aa_replace_profiles+0x213/0x33c0\n policy_update+0x261/0x370\n profile_replace+0x20e/0x2a0\n vfs_write+0x2af/0xe00\n ksys_write+0x126/0x250\n do_syscall_64+0x46/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n \u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---\nRIP: 0010:strlen+0x1e/0xa0\n\nIt seems such behaviour of aa_splitn_fqname() is expected and checked in\nother places where it is called (e.g. aa_remove_profiles). Well, there\nis an explicit comment \"a ns name without a following profile is allowed\"\ninside.\n\nAFAICS, nothing can prevent unpacked \"name\" to be in form like\n\":samba-dcerpcd\" - it is passed from userspace.\n\nDeny the whole profile set replacement in such case and inform user with\nEPROTO and an explaining message.\n\nFound by Linux Verification Center (linuxtesting.org)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:25.961Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9286ee97aa4803d99185768735011d0d65827c9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d8e62b5569cc1466ceb8a7e4872cf10160a9dcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ff00408e5029d3550ee77f62dc15f1e15c47f87"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a12db736edbb4933e4274932aeea594b5876fa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d4fa5fe2b1d56662afd14915a73b4d0783ffa45"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c0392fdafb0a2321311900be83ffa572bef8203"
        },
        {
          "url": "https://git.kernel.org/stable/c/77ab09b92f16c8439a948d1af489196953dc4a0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/55a8210c9e7d21ff2644809699765796d4bfb200"
        }
      ],
      "title": "apparmor: avoid crash when parsed profile name is empty",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52443",
    "datePublished": "2024-02-22T16:13:31.154Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-05-11T19:27:25.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52444 (GCVE-0-2023-52444)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

f2fs: fix to avoid dirent corruption

Summary

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail]

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

10 references

URL	Tags
https://git.kernel.org/stable/c/02160112e6d45c261…
https://git.kernel.org/stable/c/5624a3c1b1ebc8991…
https://git.kernel.org/stable/c/6f866885e147d33ef…
https://git.kernel.org/stable/c/f100ba617d8be6c98…
https://git.kernel.org/stable/c/f0145860c20be6bae…
https://git.kernel.org/stable/c/d3c0b49aaa12a61d5…
https://git.kernel.org/stable/c/2fb4867f4405aea8c…
https://git.kernel.org/stable/c/53edb549565f55ccd…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < 02160112e6d45c2610b049df6eb693d7a2e57b46 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < 5624a3c1b1ebc8991318e1cce2aa719542991024 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < 6f866885e147d33efc497f1095f35b2ee5ec7310 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < f100ba617d8be6c98a68f3744ef7617082975b77 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < f0145860c20be6bae6785c7a2249577674702ac7 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < d3c0b49aaa12a61d560528f5d605029ab57f0728 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < 2fb4867f4405aea8c0519d7d188207f232a57862 (git) Affected: 7e01e7ad746bc8198a8b46163ddc73a1c7d22339 , < 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52444",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-26T17:55:52.107706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:03.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.853Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "02160112e6d45c2610b049df6eb693d7a2e57b46",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "5624a3c1b1ebc8991318e1cce2aa719542991024",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "6f866885e147d33efc497f1095f35b2ee5ec7310",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "f100ba617d8be6c98a68f3744ef7617082975b77",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "f0145860c20be6bae6785c7a2249577674702ac7",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "d3c0b49aaa12a61d560528f5d605029ab57f0728",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "2fb4867f4405aea8c0519d7d188207f232a57862",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            },
            {
              "lessThan": "53edb549565f55ccd0bdf43be3d66ce4c2d48b28",
              "status": "affected",
              "version": "7e01e7ad746bc8198a8b46163ddc73a1c7d22339",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid dirent corruption\n\nAs Al reported in link[1]:\n\nf2fs_rename()\n...\n\tif (old_dir != new_dir \u0026\u0026 !whiteout)\n\t\tf2fs_set_link(old_inode, old_dir_entry,\n\t\t\t\t\told_dir_page, new_dir);\n\telse\n\t\tf2fs_put_page(old_dir_page, 0);\n\nYou want correct inumber in the \"..\" link.  And cross-directory\nrename does move the source to new parent, even if you\u0027d been asked\nto leave a whiteout in the old place.\n\n[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/\n\nWith below testcase, it may cause dirent corruption, due to it missed\nto call f2fs_set_link() to update \"..\" link to new directory.\n- mkdir -p dir/foo\n- renameat2 -w dir/foo bar\n\n[ASSERT] (__chk_dots_dentries:1421)  --\u003e Bad inode number[0x4] for \u0027..\u0027, parent parent ino is [0x3]\n[FSCK] other corrupted bugs                           [Fail]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:27.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/02160112e6d45c2610b049df6eb693d7a2e57b46"
        },
        {
          "url": "https://git.kernel.org/stable/c/5624a3c1b1ebc8991318e1cce2aa719542991024"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f866885e147d33efc497f1095f35b2ee5ec7310"
        },
        {
          "url": "https://git.kernel.org/stable/c/f100ba617d8be6c98a68f3744ef7617082975b77"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0145860c20be6bae6785c7a2249577674702ac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3c0b49aaa12a61d560528f5d605029ab57f0728"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fb4867f4405aea8c0519d7d188207f232a57862"
        },
        {
          "url": "https://git.kernel.org/stable/c/53edb549565f55ccd0bdf43be3d66ce4c2d48b28"
        }
      ],
      "title": "f2fs: fix to avoid dirent corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52444",
    "datePublished": "2024-02-22T16:21:37.043Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-05-11T19:27:27.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52445 (GCVE-0-2023-52445)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

media: pvrusb2: fix use after free on context disconnection

Summary

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

10 references

URL	Tags
https://git.kernel.org/stable/c/ec36c134dd020d28e…
https://git.kernel.org/stable/c/47aa8fcd5e8b5563a…
https://git.kernel.org/stable/c/3233d8bf789355004…
https://git.kernel.org/stable/c/ec3634ebe23fc3c44…
https://git.kernel.org/stable/c/30773ea47d41773f9…
https://git.kernel.org/stable/c/2cf0005d315549b8d…
https://git.kernel.org/stable/c/437b5f57732bb4cc3…
https://git.kernel.org/stable/c/ded85b0c0edd8f45f…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e5be15c63804e05b5a94197524023702a259e308 , < ec36c134dd020d28e312c2f1766f85525e747aab (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < 47aa8fcd5e8b5563af4042a00f25ba89bef8f33d (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < 3233d8bf7893550045682192cb227af7fa3defeb (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < ec3634ebe23fc3c44ebc67c6d25917300bc68c08 (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < 30773ea47d41773f9611ffb4ebc9bda9d19a9e7e (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < 2cf0005d315549b8d2b940ff96a66c2a889aa795 (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < 437b5f57732bb4cc32cc9f8895d2010ee9ff521c (git) Affected: e5be15c63804e05b5a94197524023702a259e308 , < ded85b0c0edd8f45fec88783d7555a5b982449c1 (git)
Linux	Linux	Affected: 2.6.26 Unaffected: 0 , < 2.6.26 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.783Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:02:46.257371Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:51.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/pvrusb2/pvrusb2-context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec36c134dd020d28e312c2f1766f85525e747aab",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "47aa8fcd5e8b5563af4042a00f25ba89bef8f33d",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "3233d8bf7893550045682192cb227af7fa3defeb",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "ec3634ebe23fc3c44ebc67c6d25917300bc68c08",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "30773ea47d41773f9611ffb4ebc9bda9d19a9e7e",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "2cf0005d315549b8d2b940ff96a66c2a889aa795",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "437b5f57732bb4cc32cc9f8895d2010ee9ff521c",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            },
            {
              "lessThan": "ded85b0c0edd8f45fec88783d7555a5b982449c1",
              "status": "affected",
              "version": "e5be15c63804e05b5a94197524023702a259e308",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/pvrusb2/pvrusb2-context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix use after free on context disconnection\n\nUpon module load, a kthread is created targeting the\npvr2_context_thread_func function, which may call pvr2_context_destroy\nand thus call kfree() on the context object. However, that might happen\nbefore the usb hub_event handler is able to notify the driver. This\npatch adds a sanity check before the invalid read reported by syzbot,\nwithin the context disconnection call stack."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:28.337Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec36c134dd020d28e312c2f1766f85525e747aab"
        },
        {
          "url": "https://git.kernel.org/stable/c/47aa8fcd5e8b5563af4042a00f25ba89bef8f33d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3233d8bf7893550045682192cb227af7fa3defeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec3634ebe23fc3c44ebc67c6d25917300bc68c08"
        },
        {
          "url": "https://git.kernel.org/stable/c/30773ea47d41773f9611ffb4ebc9bda9d19a9e7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cf0005d315549b8d2b940ff96a66c2a889aa795"
        },
        {
          "url": "https://git.kernel.org/stable/c/437b5f57732bb4cc32cc9f8895d2010ee9ff521c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ded85b0c0edd8f45fec88783d7555a5b982449c1"
        }
      ],
      "title": "media: pvrusb2: fix use after free on context disconnection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52445",
    "datePublished": "2024-02-22T16:21:37.784Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-05-11T19:27:28.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52446 (GCVE-0-2023-52446)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

bpf: Fix a race condition between btf_put() and map_free()

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a race condition between btf_put() and map_free() When running `./test_progs -j` in my local vm with latest kernel, I once hit a kasan error like below: [ 1887.184724] BUG: KASAN: slab-use-after-free in bpf_rb_root_free+0x1f8/0x2b0 [ 1887.185599] Read of size 4 at addr ffff888106806910 by task kworker/u12:2/2830 [ 1887.186498] [ 1887.186712] CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G OEL 6.7.0-rc3-00699-g90679706d486-dirty #494 [ 1887.188034] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1887.189618] Workqueue: events_unbound bpf_map_free_deferred [ 1887.190341] Call Trace: [ 1887.190666] <TASK> [ 1887.190949] dump_stack_lvl+0xac/0xe0 [ 1887.191423] ? nf_tcp_handle_invalid+0x1b0/0x1b0 [ 1887.192019] ? panic+0x3c0/0x3c0 [ 1887.192449] print_report+0x14f/0x720 [ 1887.192930] ? preempt_count_sub+0x1c/0xd0 [ 1887.193459] ? __virt_addr_valid+0xac/0x120 [ 1887.194004] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.194572] kasan_report+0xc3/0x100 [ 1887.195085] ? bpf_rb_root_free+0x1f8/0x2b0 [ 1887.195668] bpf_rb_root_free+0x1f8/0x2b0 [ 1887.196183] ? __bpf_obj_drop_impl+0xb0/0xb0 [ 1887.196736] ? preempt_count_sub+0x1c/0xd0 [ 1887.197270] ? preempt_count_sub+0x1c/0xd0 [ 1887.197802] ? _raw_spin_unlock+0x1f/0x40 [ 1887.198319] bpf_obj_free_fields+0x1d4/0x260 [ 1887.198883] array_map_free+0x1a3/0x260 [ 1887.199380] bpf_map_free_deferred+0x7b/0xe0 [ 1887.199943] process_scheduled_works+0x3a2/0x6c0 [ 1887.200549] worker_thread+0x633/0x890 [ 1887.201047] ? __kthread_parkme+0xd7/0xf0 [ 1887.201574] ? kthread+0x102/0x1d0 [ 1887.202020] kthread+0x1ab/0x1d0 [ 1887.202447] ? pr_cont_work+0x270/0x270 [ 1887.202954] ? kthread_blkcg+0x50/0x50 [ 1887.203444] ret_from_fork+0x34/0x50 [ 1887.203914] ? kthread_blkcg+0x50/0x50 [ 1887.204397] ret_from_fork_asm+0x11/0x20 [ 1887.204913] </TASK> [ 1887.204913] </TASK> [ 1887.205209] [ 1887.205416] Allocated by task 2197: [ 1887.205881] kasan_set_track+0x3f/0x60 [ 1887.206366] __kasan_kmalloc+0x6e/0x80 [ 1887.206856] __kmalloc+0xac/0x1a0 [ 1887.207293] btf_parse_fields+0xa15/0x1480 [ 1887.207836] btf_parse_struct_metas+0x566/0x670 [ 1887.208387] btf_new_fd+0x294/0x4d0 [ 1887.208851] __sys_bpf+0x4ba/0x600 [ 1887.209292] __x64_sys_bpf+0x41/0x50 [ 1887.209762] do_syscall_64+0x4c/0xf0 [ 1887.210222] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 1887.210868] [ 1887.211074] Freed by task 36: [ 1887.211460] kasan_set_track+0x3f/0x60 [ 1887.211951] kasan_save_free_info+0x28/0x40 [ 1887.212485] ____kasan_slab_free+0x101/0x180 [ 1887.213027] __kmem_cache_free+0xe4/0x210 [ 1887.213514] btf_free+0x5b/0x130 [ 1887.213918] rcu_core+0x638/0xcc0 [ 1887.214347] __do_softirq+0x114/0x37e The error happens at bpf_rb_root_free+0x1f8/0x2b0: 00000000000034c0 <bpf_rb_root_free>: ; { 34c0: f3 0f 1e fa endbr64 34c4: e8 00 00 00 00 callq 0x34c9 <bpf_rb_root_free+0x9> 34c9: 55 pushq %rbp 34ca: 48 89 e5 movq %rsp, %rbp ... ; if (rec && rec->refcount_off >= 0 && 36aa: 4d 85 ed testq %r13, %r13 36ad: 74 a9 je 0x3658 <bpf_rb_root_free+0x198> 36af: 49 8d 7d 10 leaq 0x10(%r13), %rdi 36b3: e8 00 00 00 00 callq 0x36b8 <bpf_rb_root_free+0x1f8> <==== kasan function 36b8: 45 8b 7d 10 movl 0x10(%r13), %r15d <==== use-after-free load 36bc: 45 85 ff testl %r15d, %r15d 36bf: 78 8c js 0x364d <bpf_rb_root_free+0x18d> So the problem ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/d048dced8ea5eac67…
https://git.kernel.org/stable/c/f9ff6ef1c73cd9e1a…
https://git.kernel.org/stable/c/59e5791f59dd83e8a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 958cf2e273f0929c66169e0788031310e8118722 , < d048dced8ea5eac6723ae873a40567e6f101ea42 (git) Affected: 958cf2e273f0929c66169e0788031310e8118722 , < f9ff6ef1c73cd9e1a6bb1ab3e57c5d141a536306 (git) Affected: 958cf2e273f0929c66169e0788031310e8118722 , < 59e5791f59dd83e8aa72a4e74217eabb6e8cfd90 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52446",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T19:48:46.097566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T19:48:56.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d048dced8ea5eac6723ae873a40567e6f101ea42"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f9ff6ef1c73cd9e1a6bb1ab3e57c5d141a536306"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/59e5791f59dd83e8aa72a4e74217eabb6e8cfd90"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/syscall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d048dced8ea5eac6723ae873a40567e6f101ea42",
              "status": "affected",
              "version": "958cf2e273f0929c66169e0788031310e8118722",
              "versionType": "git"
            },
            {
              "lessThan": "f9ff6ef1c73cd9e1a6bb1ab3e57c5d141a536306",
              "status": "affected",
              "version": "958cf2e273f0929c66169e0788031310e8118722",
              "versionType": "git"
            },
            {
              "lessThan": "59e5791f59dd83e8aa72a4e74217eabb6e8cfd90",
              "status": "affected",
              "version": "958cf2e273f0929c66169e0788031310e8118722",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/syscall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix a race condition between btf_put() and map_free()\n\nWhen running `./test_progs -j` in my local vm with latest kernel,\nI once hit a kasan error like below:\n\n  [ 1887.184724] BUG: KASAN: slab-use-after-free in bpf_rb_root_free+0x1f8/0x2b0\n  [ 1887.185599] Read of size 4 at addr ffff888106806910 by task kworker/u12:2/2830\n  [ 1887.186498]\n  [ 1887.186712] CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G           OEL     6.7.0-rc3-00699-g90679706d486-dirty #494\n  [ 1887.188034] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n  [ 1887.189618] Workqueue: events_unbound bpf_map_free_deferred\n  [ 1887.190341] Call Trace:\n  [ 1887.190666]  \u003cTASK\u003e\n  [ 1887.190949]  dump_stack_lvl+0xac/0xe0\n  [ 1887.191423]  ? nf_tcp_handle_invalid+0x1b0/0x1b0\n  [ 1887.192019]  ? panic+0x3c0/0x3c0\n  [ 1887.192449]  print_report+0x14f/0x720\n  [ 1887.192930]  ? preempt_count_sub+0x1c/0xd0\n  [ 1887.193459]  ? __virt_addr_valid+0xac/0x120\n  [ 1887.194004]  ? bpf_rb_root_free+0x1f8/0x2b0\n  [ 1887.194572]  kasan_report+0xc3/0x100\n  [ 1887.195085]  ? bpf_rb_root_free+0x1f8/0x2b0\n  [ 1887.195668]  bpf_rb_root_free+0x1f8/0x2b0\n  [ 1887.196183]  ? __bpf_obj_drop_impl+0xb0/0xb0\n  [ 1887.196736]  ? preempt_count_sub+0x1c/0xd0\n  [ 1887.197270]  ? preempt_count_sub+0x1c/0xd0\n  [ 1887.197802]  ? _raw_spin_unlock+0x1f/0x40\n  [ 1887.198319]  bpf_obj_free_fields+0x1d4/0x260\n  [ 1887.198883]  array_map_free+0x1a3/0x260\n  [ 1887.199380]  bpf_map_free_deferred+0x7b/0xe0\n  [ 1887.199943]  process_scheduled_works+0x3a2/0x6c0\n  [ 1887.200549]  worker_thread+0x633/0x890\n  [ 1887.201047]  ? __kthread_parkme+0xd7/0xf0\n  [ 1887.201574]  ? kthread+0x102/0x1d0\n  [ 1887.202020]  kthread+0x1ab/0x1d0\n  [ 1887.202447]  ? pr_cont_work+0x270/0x270\n  [ 1887.202954]  ? kthread_blkcg+0x50/0x50\n  [ 1887.203444]  ret_from_fork+0x34/0x50\n  [ 1887.203914]  ? kthread_blkcg+0x50/0x50\n  [ 1887.204397]  ret_from_fork_asm+0x11/0x20\n  [ 1887.204913]  \u003c/TASK\u003e\n  [ 1887.204913]  \u003c/TASK\u003e\n  [ 1887.205209]\n  [ 1887.205416] Allocated by task 2197:\n  [ 1887.205881]  kasan_set_track+0x3f/0x60\n  [ 1887.206366]  __kasan_kmalloc+0x6e/0x80\n  [ 1887.206856]  __kmalloc+0xac/0x1a0\n  [ 1887.207293]  btf_parse_fields+0xa15/0x1480\n  [ 1887.207836]  btf_parse_struct_metas+0x566/0x670\n  [ 1887.208387]  btf_new_fd+0x294/0x4d0\n  [ 1887.208851]  __sys_bpf+0x4ba/0x600\n  [ 1887.209292]  __x64_sys_bpf+0x41/0x50\n  [ 1887.209762]  do_syscall_64+0x4c/0xf0\n  [ 1887.210222]  entry_SYSCALL_64_after_hwframe+0x63/0x6b\n  [ 1887.210868]\n  [ 1887.211074] Freed by task 36:\n  [ 1887.211460]  kasan_set_track+0x3f/0x60\n  [ 1887.211951]  kasan_save_free_info+0x28/0x40\n  [ 1887.212485]  ____kasan_slab_free+0x101/0x180\n  [ 1887.213027]  __kmem_cache_free+0xe4/0x210\n  [ 1887.213514]  btf_free+0x5b/0x130\n  [ 1887.213918]  rcu_core+0x638/0xcc0\n  [ 1887.214347]  __do_softirq+0x114/0x37e\n\nThe error happens at bpf_rb_root_free+0x1f8/0x2b0:\n\n  00000000000034c0 \u003cbpf_rb_root_free\u003e:\n  ; {\n    34c0: f3 0f 1e fa                   endbr64\n    34c4: e8 00 00 00 00                callq   0x34c9 \u003cbpf_rb_root_free+0x9\u003e\n    34c9: 55                            pushq   %rbp\n    34ca: 48 89 e5                      movq    %rsp, %rbp\n  ...\n  ;       if (rec \u0026\u0026 rec-\u003erefcount_off \u003e= 0 \u0026\u0026\n    36aa: 4d 85 ed                      testq   %r13, %r13\n    36ad: 74 a9                         je      0x3658 \u003cbpf_rb_root_free+0x198\u003e\n    36af: 49 8d 7d 10                   leaq    0x10(%r13), %rdi\n    36b3: e8 00 00 00 00                callq   0x36b8 \u003cbpf_rb_root_free+0x1f8\u003e\n                                        \u003c==== kasan function\n    36b8: 45 8b 7d 10                   movl    0x10(%r13), %r15d\n                                        \u003c==== use-after-free load\n    36bc: 45 85 ff                      testl   %r15d, %r15d\n    36bf: 78 8c                         js      0x364d \u003cbpf_rb_root_free+0x18d\u003e\n\nSo the problem \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:29.463Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d048dced8ea5eac6723ae873a40567e6f101ea42"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9ff6ef1c73cd9e1a6bb1ab3e57c5d141a536306"
        },
        {
          "url": "https://git.kernel.org/stable/c/59e5791f59dd83e8aa72a4e74217eabb6e8cfd90"
        }
      ],
      "title": "bpf: Fix a race condition between btf_put() and map_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52446",
    "datePublished": "2024-02-22T16:21:38.408Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-05-11T19:27:29.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52447 (GCVE-0-2023-52447)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-12 11:21

Title

bpf: Defer the free of inner map when necessary

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/90c445799fd1dc214…
https://git.kernel.org/stable/c/37d98fb9c3144c0fd…
https://git.kernel.org/stable/c/62fca83303d608ad4…
https://git.kernel.org/stable/c/f91cd728b10c51f6d…
https://git.kernel.org/stable/c/bfd9b20c4862f41d4…
https://git.kernel.org/stable/c/876673364161da50e…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: bba1dc0b55ac462d24ed1228ad49800c238cd6d7 , < 90c445799fd1dc214d7c6279c144e33a35e29ef2 (git) Affected: bba1dc0b55ac462d24ed1228ad49800c238cd6d7 , < 37d98fb9c3144c0fddf7f6e99aece9927ac8dce6 (git) Affected: bba1dc0b55ac462d24ed1228ad49800c238cd6d7 , < 62fca83303d608ad4fec3f7428c8685680bb01b0 (git) Affected: bba1dc0b55ac462d24ed1228ad49800c238cd6d7 , < f91cd728b10c51f6d4a39957ccd56d1e802fc8ee (git) Affected: bba1dc0b55ac462d24ed1228ad49800c238cd6d7 , < bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 (git) Affected: bba1dc0b55ac462d24ed1228ad49800c238cd6d7 , < 876673364161da50eed6b472d746ef88242b2368 (git)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.214 , ≤ 5.10.* (semver) Unaffected: 5.15.153 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: bba1dc0b55ac , < 90c445799fd1 (git) Affected: bba1dc0b55ac , < 37d98fb9c314 (git) Affected: bba1dc0b55ac , < 62fca83303d6 (git) Affected: bba1dc0b55ac , < f91cd728b10c (git) Affected: bba1dc0b55ac , < bfd9b20c4862 (git) Affected: bba1dc0b55ac , < 876673364161 (git) cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	Affected: 5.9 cpe:2.3:o:linux:linux_kernel:5.9:::::::*
linux	linux_kernel	Unaffected: 0 , < 5.9 (custom) Unaffected: 5.10.214 , ≤ 5.10.* (custom) Unaffected: 5.15.153 , ≤ 5.15.* (custom) Unaffected: 6.1.75 , ≤ 6.1.* (custom) Unaffected: 6.6.14 , ≤ 6.6.* (custom) Unaffected: 6.7.2 , ≤ 6.7.* (custom) Unaffected: 6.8 , ≤ * (custom) cpe:2.3:o:linux:linux_kernel::::::::
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "90c445799fd1",
                "status": "affected",
                "version": "bba1dc0b55ac",
                "versionType": "git"
              },
              {
                "lessThan": "37d98fb9c314",
                "status": "affected",
                "version": "bba1dc0b55ac",
                "versionType": "git"
              },
              {
                "lessThan": "62fca83303d6",
                "status": "affected",
                "version": "bba1dc0b55ac",
                "versionType": "git"
              },
              {
                "lessThan": "f91cd728b10c",
                "status": "affected",
                "version": "bba1dc0b55ac",
                "versionType": "git"
              },
              {
                "lessThan": "bfd9b20c4862",
                "status": "affected",
                "version": "bba1dc0b55ac",
                "versionType": "git"
              },
              {
                "lessThan": "876673364161",
                "status": "affected",
                "version": "bba1dc0b55ac",
                "versionType": "git"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:5.9:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.9"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.9",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.214",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.153",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.75",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.14",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7.*",
                "status": "unaffected",
                "version": "6.7.2",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.8",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52447",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T21:02:24.907266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T21:08:15.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:21:39.003Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/map_in_map.c",
            "kernel/bpf/syscall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90c445799fd1dc214d7c6279c144e33a35e29ef2",
              "status": "affected",
              "version": "bba1dc0b55ac462d24ed1228ad49800c238cd6d7",
              "versionType": "git"
            },
            {
              "lessThan": "37d98fb9c3144c0fddf7f6e99aece9927ac8dce6",
              "status": "affected",
              "version": "bba1dc0b55ac462d24ed1228ad49800c238cd6d7",
              "versionType": "git"
            },
            {
              "lessThan": "62fca83303d608ad4fec3f7428c8685680bb01b0",
              "status": "affected",
              "version": "bba1dc0b55ac462d24ed1228ad49800c238cd6d7",
              "versionType": "git"
            },
            {
              "lessThan": "f91cd728b10c51f6d4a39957ccd56d1e802fc8ee",
              "status": "affected",
              "version": "bba1dc0b55ac462d24ed1228ad49800c238cd6d7",
              "versionType": "git"
            },
            {
              "lessThan": "bfd9b20c4862f41d4590fde11d70a5eeae53dcc5",
              "status": "affected",
              "version": "bba1dc0b55ac462d24ed1228ad49800c238cd6d7",
              "versionType": "git"
            },
            {
              "lessThan": "876673364161da50eed6b472d746ef88242b2368",
              "status": "affected",
              "version": "bba1dc0b55ac462d24ed1228ad49800c238cd6d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h",
            "kernel/bpf/map_in_map.c",
            "kernel/bpf/syscall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Defer the free of inner map when necessary\n\nWhen updating or deleting an inner map in map array or map htab, the map\nmay still be accessed by non-sleepable program or sleepable program.\nHowever bpf_map_fd_put_ptr() decreases the ref-counter of the inner map\ndirectly through bpf_map_put(), if the ref-counter is the last one\n(which is true for most cases), the inner map will be freed by\nops-\u003emap_free() in a kworker. But for now, most .map_free() callbacks\ndon\u0027t use synchronize_rcu() or its variants to wait for the elapse of a\nRCU grace period, so after the invocation of ops-\u003emap_free completes,\nthe bpf program which is accessing the inner map may incur\nuse-after-free problem.\n\nFix the free of inner map by invoking bpf_map_free_deferred() after both\none RCU grace period and one tasks trace RCU grace period if the inner\nmap has been removed from the outer map before. The deferment is\naccomplished by using call_rcu() or call_rcu_tasks_trace() when\nreleasing the last ref-counter of bpf map. The newly-added rcu_head\nfield in bpf_map shares the same storage space with work field to\nreduce the size of bpf_map."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:30.626Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2"
        },
        {
          "url": "https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368"
        }
      ],
      "title": "bpf: Defer the free of inner map when necessary",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52447",
    "datePublished": "2024-02-22T16:21:39.032Z",
    "dateReserved": "2024-02-20T12:30:33.292Z",
    "dateUpdated": "2026-05-12T11:21:39.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52448 (GCVE-0-2023-52448)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump

Summary

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/efc8ef87ab9185a23…
https://git.kernel.org/stable/c/5c28478af371a1c3f…
https://git.kernel.org/stable/c/ee0586d73cbaf0e70…
https://git.kernel.org/stable/c/d69d7804cf9e2ba17…
https://git.kernel.org/stable/c/067a7c48c2c70f05f…
https://git.kernel.org/stable/c/c323efd620c741168…
https://git.kernel.org/stable/c/8877243beafa7c6bf…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < efc8ef87ab9185a23d5676f2f7d986022d91bcde (git) Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < 5c28478af371a1c3fdb570ca67f110e1ae60fc37 (git) Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < ee0586d73cbaf0e7058bc640d62a9daf2dfa9178 (git) Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < d69d7804cf9e2ba171a27e5f98bc266f13d0414a (git) Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < 067a7c48c2c70f05f9460d6f0e8423e234729f05 (git) Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < c323efd620c741168c8e0cc6fc0be04ab57e331a (git) Affected: 72244b6bc752b5c496f09de9a13c18adc314a53c , < 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52448",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-28T18:52:46.347708Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:58.504Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.668Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/efc8ef87ab9185a23d5676f2f7d986022d91bcde"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5c28478af371a1c3fdb570ca67f110e1ae60fc37"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ee0586d73cbaf0e7058bc640d62a9daf2dfa9178"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d69d7804cf9e2ba171a27e5f98bc266f13d0414a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/067a7c48c2c70f05f9460d6f0e8423e234729f05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c323efd620c741168c8e0cc6fc0be04ab57e331a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8877243beafa7c6bfc42022cbfdf9e39b25bd4fa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/rgrp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "efc8ef87ab9185a23d5676f2f7d986022d91bcde",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            },
            {
              "lessThan": "5c28478af371a1c3fdb570ca67f110e1ae60fc37",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            },
            {
              "lessThan": "ee0586d73cbaf0e7058bc640d62a9daf2dfa9178",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            },
            {
              "lessThan": "d69d7804cf9e2ba171a27e5f98bc266f13d0414a",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            },
            {
              "lessThan": "067a7c48c2c70f05f9460d6f0e8423e234729f05",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            },
            {
              "lessThan": "c323efd620c741168c8e0cc6fc0be04ab57e331a",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            },
            {
              "lessThan": "8877243beafa7c6bfc42022cbfdf9e39b25bd4fa",
              "status": "affected",
              "version": "72244b6bc752b5c496f09de9a13c18adc314a53c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/rgrp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump\n\nSyzkaller has reported a NULL pointer dereference when accessing\nrgd-\u003erd_rgl in gfs2_rgrp_dump().  This can happen when creating\nrgd-\u003erd_gl fails in read_rindex_entry().  Add a NULL pointer check in\ngfs2_rgrp_dump() to prevent that."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:31.761Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/efc8ef87ab9185a23d5676f2f7d986022d91bcde"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c28478af371a1c3fdb570ca67f110e1ae60fc37"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee0586d73cbaf0e7058bc640d62a9daf2dfa9178"
        },
        {
          "url": "https://git.kernel.org/stable/c/d69d7804cf9e2ba171a27e5f98bc266f13d0414a"
        },
        {
          "url": "https://git.kernel.org/stable/c/067a7c48c2c70f05f9460d6f0e8423e234729f05"
        },
        {
          "url": "https://git.kernel.org/stable/c/c323efd620c741168c8e0cc6fc0be04ab57e331a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8877243beafa7c6bfc42022cbfdf9e39b25bd4fa"
        }
      ],
      "title": "gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52448",
    "datePublished": "2024-02-22T16:21:39.915Z",
    "dateReserved": "2024-02-20T12:30:33.292Z",
    "dateUpdated": "2026-05-11T19:27:31.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52449 (GCVE-0-2023-52449)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

mtd: Fix gluebi NULL pointer dereference caused by ftl notifier

Summary

In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

10 references

URL	Tags
https://git.kernel.org/stable/c/aeba358bcc8ffddf9…
https://git.kernel.org/stable/c/1bf4fe14e97cda621…
https://git.kernel.org/stable/c/001a3f59d8c914ef8…
https://git.kernel.org/stable/c/d8ac2537763b54d27…
https://git.kernel.org/stable/c/5389407bba1eab126…
https://git.kernel.org/stable/c/cfd7c9d260dc0a3ba…
https://git.kernel.org/stable/c/b36aaa64d58aaa2f2…
https://git.kernel.org/stable/c/a43bdc376deab5fff…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022 (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < 1bf4fe14e97cda621522eb2f28b0a4e87c5b0745 (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < 001a3f59d8c914ef8273461d4bf495df384cc5f8 (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < d8ac2537763b54d278b80b2b080e1652523c7d4c (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < 5389407bba1eab1266c6d83e226fb0840cb98dd5 (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < cfd7c9d260dc0a3baaea05a122a19ab91e193c65 (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc (git) Affected: 2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba , < a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 (git)
Linux	Linux	Affected: 2.6.31 Unaffected: 0 , < 2.6.31 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T20:55:21.816899Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:07.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.518Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1bf4fe14e97cda621522eb2f28b0a4e87c5b0745"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/001a3f59d8c914ef8273461d4bf495df384cc5f8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d8ac2537763b54d278b80b2b080e1652523c7d4c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5389407bba1eab1266c6d83e226fb0840cb98dd5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfd7c9d260dc0a3baaea05a122a19ab91e193c65"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/mtd_blkdevs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "1bf4fe14e97cda621522eb2f28b0a4e87c5b0745",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "001a3f59d8c914ef8273461d4bf495df384cc5f8",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "d8ac2537763b54d278b80b2b080e1652523c7d4c",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "5389407bba1eab1266c6d83e226fb0840cb98dd5",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "cfd7c9d260dc0a3baaea05a122a19ab91e193c65",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            },
            {
              "lessThan": "a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6",
              "status": "affected",
              "version": "2ba3d76a1e29f2ba64fbc762875cf9fb2d4ba2ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mtd/mtd_blkdevs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: Fix gluebi NULL pointer dereference caused by ftl notifier\n\nIf both ftl.ko and gluebi.ko are loaded, the notifier of ftl\ntriggers NULL pointer dereference when trying to access\n\u2018gluebi-\u003edesc\u2019 in gluebi_read().\n\nubi_gluebi_init\n  ubi_register_volume_notifier\n    ubi_enumerate_volumes\n      ubi_notify_all\n        gluebi_notify    nb-\u003enotifier_call()\n          gluebi_create\n            mtd_device_register\n              mtd_device_parse_register\n                add_mtd_device\n                  blktrans_notify_add   not-\u003eadd()\n                    ftl_add_mtd         tr-\u003eadd_mtd()\n                      scan_header\n                        mtd_read\n                          mtd_read_oob\n                            mtd_read_oob_std\n                              gluebi_read   mtd-\u003eread()\n                                gluebi-\u003edesc - NULL\n\nDetailed reproduction information available at the Link [1],\n\nIn the normal case, obtain gluebi-\u003edesc in the gluebi_get_device(),\nand access gluebi-\u003edesc in the gluebi_read(). However,\ngluebi_get_device() is not executed in advance in the\nftl_add_mtd() process, which leads to NULL pointer dereference.\n\nThe solution for the gluebi module is to run jffs2 on the UBI\nvolume without considering working with ftl or mtdblock [2].\nTherefore, this problem can be avoided by preventing gluebi from\ncreating the mtdblock device after creating mtd partition of the\ntype MTD_UBIVOLUME."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:32.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bf4fe14e97cda621522eb2f28b0a4e87c5b0745"
        },
        {
          "url": "https://git.kernel.org/stable/c/001a3f59d8c914ef8273461d4bf495df384cc5f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8ac2537763b54d278b80b2b080e1652523c7d4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5389407bba1eab1266c6d83e226fb0840cb98dd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd7c9d260dc0a3baaea05a122a19ab91e193c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/b36aaa64d58aaa2f2cbc8275e89bae76a2b6c3dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6"
        }
      ],
      "title": "mtd: Fix gluebi NULL pointer dereference caused by ftl notifier",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52449",
    "datePublished": "2024-02-22T16:21:40.841Z",
    "dateReserved": "2024-02-20T12:30:33.292Z",
    "dateUpdated": "2026-05-11T19:27:32.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52450 (GCVE-0-2023-52450)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()

Summary

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logical socket id instead of physical id in discover_upi_topology() to avoid out-of-bound access on 'upi = &type->topology[nid][idx];' line that leads to NULL pointer dereference in upi_fill_topology()

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/bf1bf09e6b5997588…
https://git.kernel.org/stable/c/3d6f4a78b104c65e4…
https://git.kernel.org/stable/c/1692cf434ba13ee21…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f680b6e6062ef3c944ffc966d685f067958fca33 , < bf1bf09e6b599758851457f3999779622a48d015 (git) Affected: f680b6e6062ef3c944ffc966d685f067958fca33 , < 3d6f4a78b104c65e4256c3776c9949f49a1b459e (git) Affected: f680b6e6062ef3c944ffc966d685f067958fca33 , < 1692cf434ba13ee212495b5af795b6a07e986ce4 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bf1bf09e6b599758851457f3999779622a48d015"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3d6f4a78b104c65e4256c3776c9949f49a1b459e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1692cf434ba13ee212495b5af795b6a07e986ce4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:02:43.172310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:50.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/uncore_snbep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf1bf09e6b599758851457f3999779622a48d015",
              "status": "affected",
              "version": "f680b6e6062ef3c944ffc966d685f067958fca33",
              "versionType": "git"
            },
            {
              "lessThan": "3d6f4a78b104c65e4256c3776c9949f49a1b459e",
              "status": "affected",
              "version": "f680b6e6062ef3c944ffc966d685f067958fca33",
              "versionType": "git"
            },
            {
              "lessThan": "1692cf434ba13ee212495b5af795b6a07e986ce4",
              "status": "affected",
              "version": "f680b6e6062ef3c944ffc966d685f067958fca33",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/intel/uncore_snbep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()\n\nGet logical socket id instead of physical id in discover_upi_topology()\nto avoid out-of-bound access on \u0027upi = \u0026type-\u003etopology[nid][idx];\u0027 line\nthat leads to NULL pointer dereference in upi_fill_topology()"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:34.006Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf1bf09e6b599758851457f3999779622a48d015"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d6f4a78b104c65e4256c3776c9949f49a1b459e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1692cf434ba13ee212495b5af795b6a07e986ce4"
        }
      ],
      "title": "perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52450",
    "datePublished": "2024-02-22T16:21:41.661Z",
    "dateReserved": "2024-02-20T12:30:33.293Z",
    "dateUpdated": "2026-05-11T19:27:34.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52451 (GCVE-0-2023-52451)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-11 19:27

Title

powerpc/pseries/memhp: Fix access beyond end of drmem array

Summary

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer: pr_debug("Failed to hot-remove memory at %llx\n", lmb->base_addr); This was found by inspection and confirmed with KASAN: pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 ================================================================== BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0) ================================================================== pseries-hotplug-mem: Failed to hot-remove memory at 0 Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

9 references

URL	Tags
https://git.kernel.org/stable/c/bb79613a9a704469d…
https://git.kernel.org/stable/c/9b5f03500bc5b083c…
https://git.kernel.org/stable/c/b582aa1f66411d4ad…
https://git.kernel.org/stable/c/999a27b3ce9a69d54…
https://git.kernel.org/stable/c/026fd977dc50ff4a5…
https://git.kernel.org/stable/c/df16afba2378d9853…
https://git.kernel.org/stable/c/708a4b59baad96c47…
https://git.kernel.org/stable/c/bd68ffce69f6cf8dd…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < bb79613a9a704469ddb8d6c6029d532a5cea384c (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < 9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7 (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < b582aa1f66411d4adcc1aa55b8c575683fb4687e (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < 999a27b3ce9a69d54ccd5db000ec3a447bc43e6d (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < 026fd977dc50ff4a5e09bfb0603557f104d3f3a0 (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < df16afba2378d985359812c865a15c05c70a967e (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < 708a4b59baad96c4718dc0bd3a3427d3ab22fedc (git) Affected: 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 , < bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 (git)
Linux	Linux	Affected: 4.1 Unaffected: 0 , < 4.1 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T20:29:32.183324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:57.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bb79613a9a704469ddb8d6c6029d532a5cea384c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b582aa1f66411d4adcc1aa55b8c575683fb4687e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/999a27b3ce9a69d54ccd5db000ec3a447bc43e6d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/026fd977dc50ff4a5e09bfb0603557f104d3f3a0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df16afba2378d985359812c865a15c05c70a967e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/708a4b59baad96c4718dc0bd3a3427d3ab22fedc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/platforms/pseries/hotplug-memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb79613a9a704469ddb8d6c6029d532a5cea384c",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "b582aa1f66411d4adcc1aa55b8c575683fb4687e",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "999a27b3ce9a69d54ccd5db000ec3a447bc43e6d",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "026fd977dc50ff4a5e09bfb0603557f104d3f3a0",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "df16afba2378d985359812c865a15c05c70a967e",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "708a4b59baad96c4718dc0bd3a3427d3ab22fedc",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            },
            {
              "lessThan": "bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5",
              "status": "affected",
              "version": "51925fb3c5c901aa06cdc853268a6e19e19bcdc7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/platforms/pseries/hotplug-memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries/memhp: Fix access beyond end of drmem array\n\ndlpar_memory_remove_by_index() may access beyond the bounds of the\ndrmem lmb array when the LMB lookup fails to match an entry with the\ngiven DRC index. When the search fails, the cursor is left pointing to\n\u0026drmem_info-\u003elmbs[drmem_info-\u003en_lmbs], which is one element past the\nlast valid entry in the array. The debug message at the end of the\nfunction then dereferences this pointer:\n\n        pr_debug(\"Failed to hot-remove memory at %llx\\n\",\n                 lmb-\u003ebase_addr);\n\nThis was found by inspection and confirmed with KASAN:\n\n  pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658\n  Read of size 8 at addr c000000364e97fd0 by task bash/949\n\n  dump_stack_lvl+0xa4/0xfc (unreliable)\n  print_report+0x214/0x63c\n  kasan_report+0x140/0x2e0\n  __asan_load8+0xa8/0xe0\n  dlpar_memory+0x298/0x1658\n  handle_dlpar_errorlog+0x130/0x1d0\n  dlpar_store+0x18c/0x3e0\n  kobj_attr_store+0x68/0xa0\n  sysfs_kf_write+0xc4/0x110\n  kernfs_fop_write_iter+0x26c/0x390\n  vfs_write+0x2d4/0x4e0\n  ksys_write+0xac/0x1a0\n  system_call_exception+0x268/0x530\n  system_call_vectored_common+0x15c/0x2ec\n\n  Allocated by task 1:\n   kasan_save_stack+0x48/0x80\n   kasan_set_track+0x34/0x50\n   kasan_save_alloc_info+0x34/0x50\n   __kasan_kmalloc+0xd0/0x120\n   __kmalloc+0x8c/0x320\n   kmalloc_array.constprop.0+0x48/0x5c\n   drmem_init+0x2a0/0x41c\n   do_one_initcall+0xe0/0x5c0\n   kernel_init_freeable+0x4ec/0x5a0\n   kernel_init+0x30/0x1e0\n   ret_from_kernel_user_thread+0x14/0x1c\n\n  The buggy address belongs to the object at c000000364e80000\n   which belongs to the cache kmalloc-128k of size 131072\n  The buggy address is located 0 bytes to the right of\n   allocated 98256-byte region [c000000364e80000, c000000364e97fd0)\n\n  ==================================================================\n  pseries-hotplug-mem: Failed to hot-remove memory at 0\n\nLog failed lookups with a separate message and dereference the\ncursor only when it points to a valid entry."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:27:35.148Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb79613a9a704469ddb8d6c6029d532a5cea384c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b582aa1f66411d4adcc1aa55b8c575683fb4687e"
        },
        {
          "url": "https://git.kernel.org/stable/c/999a27b3ce9a69d54ccd5db000ec3a447bc43e6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/026fd977dc50ff4a5e09bfb0603557f104d3f3a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/df16afba2378d985359812c865a15c05c70a967e"
        },
        {
          "url": "https://git.kernel.org/stable/c/708a4b59baad96c4718dc0bd3a3427d3ab22fedc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5"
        }
      ],
      "title": "powerpc/pseries/memhp: Fix access beyond end of drmem array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52451",
    "datePublished": "2024-02-22T16:21:42.295Z",
    "dateReserved": "2024-02-20T12:30:33.293Z",
    "dateUpdated": "2026-05-11T19:27:35.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52452 (GCVE-0-2023-52452)

Vulnerability from cvelistv5 – Published: 2024-02-22 16:21 – Updated: 2026-05-23 15:25

Title

bpf: Fix accesses to uninit stack slots

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently. In particular, accesses were permitted above state->allocated_stack, but not below it. In other words, if the stack was already "large enough", the access was permitted, but otherwise the access was rejected instead of being allowed to "grow the stack". This undesired rejection was happening in two places: - in check_stack_slot_within_bounds() - in check_stack_range_initialized() This patch arranges for these accesses to be permitted. A bunch of tests that were relying on the old rejection had to change; all of them were changed to add also run unprivileged, in which case the old behavior persists. One tests couldn't be updated - global_func16 - because it can't run unprivileged for other reasons. This patch also fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the first one because they're inter-related. Before this patch, writes to the stack using registers containing a variable offset (as opposed to registers with fixed, known values) were not properly contributing to the function's needed stack size. As a result, it was possible for a program to verify, but then to attempt to read out-of-bounds data at runtime because a too small stack had been allocated for it. Each function tracks the size of the stack it needs in bpf_subprog_info.stack_depth, which is maintained by update_stack_depth(). For regular memory accesses, check_mem_access() was calling update_state_depth() but it was passing in only the fixed part of the offset register, ignoring the variable offset. This was incorrect; the minimum possible value of that register should be used instead. This tracking is now fixed by centralizing the tracking of stack size in grow_stack_state(), and by lifting the calls to grow_stack_state() to check_stack_access_within_bounds() as suggested by Andrii. The code is now simpler and more convincingly tracks the correct maximum stack size. check_stack_range_initialized() can now rely on enough stack having been allocated for the access; this helps with the fix for the first issue. A few tests were changed to also check the stack depth computation. The one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/0954982db8283016b…
https://git.kernel.org/stable/c/fbcf372c8eda22904…
https://git.kernel.org/stable/c/6b4a64bafd107e521…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 01f810ace9ed37255f27608a0864abebccf0aab3 , < 0954982db8283016bf38e9db2da5adf47a102e19 (git) Affected: 01f810ace9ed37255f27608a0864abebccf0aab3 , < fbcf372c8eda2290470268e0afb5ab5d5f5d5fde (git) Affected: 01f810ace9ed37255f27608a0864abebccf0aab3 , < 6b4a64bafd107e521c01eec3453ce94a3fb38529 (git) Affected: f3c4b01689d392373301e6e60d1b02c5b4020afc (git) Affected: d1b725ea5d104caea250427899f4e2e3ab15b4fc (git) Affected: 5.10.33 , < 5.11 (semver) Affected: 5.11.17 , < 5.12 (semver)
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T19:34:47.236363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:01.979Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:55:41.850Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0954982db8283016bf38e9db2da5adf47a102e19"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c",
            "tools/testing/selftests/bpf/progs/iters.c",
            "tools/testing/selftests/bpf/progs/test_global_func16.c",
            "tools/testing/selftests/bpf/progs/verifier_basic_stack.c",
            "tools/testing/selftests/bpf/progs/verifier_int_ptr.c",
            "tools/testing/selftests/bpf/progs/verifier_raw_stack.c",
            "tools/testing/selftests/bpf/progs/verifier_var_off.c",
            "tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c",
            "tools/testing/selftests/bpf/verifier/calls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0954982db8283016bf38e9db2da5adf47a102e19",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "lessThan": "fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "lessThan": "6b4a64bafd107e521c01eec3453ce94a3fb38529",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3c4b01689d392373301e6e60d1b02c5b4020afc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1b725ea5d104caea250427899f4e2e3ab15b4fc",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.33",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c",
            "tools/testing/selftests/bpf/progs/iters.c",
            "tools/testing/selftests/bpf/progs/test_global_func16.c",
            "tools/testing/selftests/bpf/progs/verifier_basic_stack.c",
            "tools/testing/selftests/bpf/progs/verifier_int_ptr.c",
            "tools/testing/selftests/bpf/progs/verifier_raw_stack.c",
            "tools/testing/selftests/bpf/progs/verifier_var_off.c",
            "tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c",
            "tools/testing/selftests/bpf/verifier/calls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix accesses to uninit stack slots\n\nPrivileged programs are supposed to be able to read uninitialized stack\nmemory (ever since 6715df8d5) but, before this patch, these accesses\nwere permitted inconsistently. In particular, accesses were permitted\nabove state-\u003eallocated_stack, but not below it. In other words, if the\nstack was already \"large enough\", the access was permitted, but\notherwise the access was rejected instead of being allowed to \"grow the\nstack\". This undesired rejection was happening in two places:\n- in check_stack_slot_within_bounds()\n- in check_stack_range_initialized()\nThis patch arranges for these accesses to be permitted. A bunch of tests\nthat were relying on the old rejection had to change; all of them were\nchanged to add also run unprivileged, in which case the old behavior\npersists. One tests couldn\u0027t be updated - global_func16 - because it\ncan\u0027t run unprivileged for other reasons.\n\nThis patch also fixes the tracking of the stack size for variable-offset\nreads. This second fix is bundled in the same commit as the first one\nbecause they\u0027re inter-related. Before this patch, writes to the stack\nusing registers containing a variable offset (as opposed to registers\nwith fixed, known values) were not properly contributing to the\nfunction\u0027s needed stack size. As a result, it was possible for a program\nto verify, but then to attempt to read out-of-bounds data at runtime\nbecause a too small stack had been allocated for it.\n\nEach function tracks the size of the stack it needs in\nbpf_subprog_info.stack_depth, which is maintained by\nupdate_stack_depth(). For regular memory accesses, check_mem_access()\nwas calling update_state_depth() but it was passing in only the fixed\npart of the offset register, ignoring the variable offset. This was\nincorrect; the minimum possible value of that register should be used\ninstead.\n\nThis tracking is now fixed by centralizing the tracking of stack size in\ngrow_stack_state(), and by lifting the calls to grow_stack_state() to\ncheck_stack_access_within_bounds() as suggested by Andrii. The code is\nnow simpler and more convincingly tracks the correct maximum stack size.\ncheck_stack_range_initialized() can now rely on enough stack having been\nallocated for the access; this helps with the fix for the first issue.\n\nA few tests were changed to also check the stack depth computation. The\none that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:25:31.140Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0954982db8283016bf38e9db2da5adf47a102e19"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529"
        }
      ],
      "title": "bpf: Fix accesses to uninit stack slots",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52452",
    "datePublished": "2024-02-22T16:21:43.094Z",
    "dateReserved": "2024-02-20T12:30:33.293Z",
    "dateUpdated": "2026-05-23T15:25:31.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

usn-6765-1

Vulnerability from osv_ubuntu

CVE-2023-52443 (GCVE-0-2023-52443)

CVE-2023-52444 (GCVE-0-2023-52444)

CVE-2023-52445 (GCVE-0-2023-52445)

CVE-2023-52446 (GCVE-0-2023-52446)

CVE-2023-52447 (GCVE-0-2023-52447)

CVE-2023-52448 (GCVE-0-2023-52448)

CVE-2023-52449 (GCVE-0-2023-52449)

CVE-2023-52450 (GCVE-0-2023-52450)

CVE-2023-52451 (GCVE-0-2023-52451)

CVE-2023-52452 (GCVE-0-2023-52452)

Tags

Sightings

Nomenclature